2018-04-18 Linux Learning

11.28 restricting a directory from parsing PHP

Access Control-Disable PHP parsing

<Directory /data/wwwroot/111.com/upload>  php_admin_flag engine off</Directory>

Curl test directly back to PHP source code, did not parse

Operation Process

[Email protected] ~]# vim/usr/local/apache2.4/conf/extra/httpd-vhosts.conf
<virtualhost:80>
DocumentRoot "/data/wwwroot/111.com"
ServerName 111.com
Serveralias www.exampl.com 2111.com.cn
<Directory/data/wwwroot/111.com/upload>
Php_admin_flag engine off
<filesmatch (.). PHP (.) >
Order Allow,deny
Deny from all
</FilesMatch>
</Directory>
<Directory/data/wwwroot/111.com>
<filesmatch "admin.php (.) ">
Order Deny,allow
Deny from all
Allow from 127.0.0.1
</FilesMatch>
</Directory>
Setenvif Request_uri ".. gif$ "img
Setenvif Request_uri ".. jpg$ "img
Setenvif Request_uri ".. png$ "img
Setenvif Request_uri ".. bmp$ "img
Setenvif Request_uri ".. swf$ "img
Setenvif Request_uri ".. js$ "img
Setenvif Request_uri ". *.css$" img
Errorlog "Logs/111.com-errorLog "
Customlog "|/usr/local/apache2.4/bin/rotatelogs-l logs/111.com-access%y%m%d.log 86400 "Combined env=!img
</VirtualHost>

[[email protected] ~]# mkdir /data/wwwroot/111.com/upload[[email protected] ~]# cd /data/wwwroot/111.com/[[email protected] 111.com]# vim 123.php[[email protected] 111.com]# cp 123.php upload/[[email protected] 111.com]# curl -x127.0.0.1:80 ‘http://111.com/upload/123.php‘ -IHTTP/1.1 200 OKDate: Tue, 17 Apr 2018 15:13:20 GMTServer: Apache/2.4.29 (Unix) PHP/5.6.35X-Powered-By: PHP/5.6.35Cache-Control: max-age=0Expires: Tue, 17 Apr 2018 15:13:20 GMTContent-Type: text/html; charset=UTF-8[[email protected] 111.com]# /usr/local/apache2.4/bin/apachectl -tSyntax OK[[email protected] 111.com]# /usr/local/apache2.4/bin/apachectl graceful[[email protected] 111.com]# curl -x127.0.0.1:80 ‘http://111.com/upload/123.php‘ -IHTTP/1.1 403 ForbiddenDate: Tue, 17 Apr 2018 15:14:00 GMTServer: Apache/2.4.29 (Unix) PHP/5.6.35Content-Type: text/html; charset=iso-8859-1

11.29 Limit User_agent

Access Control-User_agent

User_agent can be understood as a browser identifier

核心配置内容<IfModule mod_rewrite.c>    RewriteEngine on    RewriteCond %{HTTP_USER_AGENT} .*curl.* [NC,OR]    RewriteCond %{HTTP_USER_AGENT} .*baidu.com.* [NC]    RewriteRule .* - [F]</IfModule>curl -A "123123" 指定 user_agent

Operation Process

[Email protected] ~]# vim/usr/local/apache2.4/conf/extra/httpd-vhosts.conf
<virtualhost:80>
DocumentRoot "/data/wwwroot/111.com"
ServerName 111.com
Serveralias www.exampl.com 2111.com.cn
<ifmodule mod_rewrite.c>
Rewriteengine on
Rewritecond%{http_user_agent}.Curl.[Nc,or]
Rewritecond%{http_user_agent}.Baidu.com.[NC]
Rewriterule.-[F]
</IfModule>
<Directory/data/wwwroot/111.com/upload>
Php_admin_flag engine off
<filesmatch (.). PHP (.) >
Order Allow,deny
Deny from all
</FilesMatch>
</Directory>
<Directory/data/wwwroot/111.com>
<filesmatch "admin.php (.) ">
Order Deny,allow
Deny from all
Allow from 127.0.0.1
</FilesMatch>
</Directory>
Setenvif Request_uri ".. gif$ "img
Setenvif Request_uri ".. jpg$ "img
Setenvif Request_uri ".. png$ "img
Setenvif Request_uri ".. bmp$ "img
Setenvif Request_uri ".. swf$ "img
Setenvif Request_uri ".. js$ "img
Setenvif Request_uri ".. css$ "img
Errorlog "Logs/111.com-errorLog "
Customlog "|/usr/local/apache2.4/bin/rotatelogs-l logs/111.com-access%y%m%d.log 86400 "Combined env=!img
</VirtualHost>

[[email protected] 111.com]# vim/data/wwwroot/111.com/123.php[[email protected] 111.com]# Curl- X127.0.0.1:80 ' http://111.com/123.php '-ihttp/1.1 okdate:tue, APR 2018 15:41:05 gmtserver:apache/2.4.29 (Unix) PH P/5.6.35x-powered-by:php/5.6.35cache-control:max-age=0expires:tue, APR 2018 15:41:05 gmtcontent-type:text/html; Charset=utf-8[[email protected] 111.com]#/usr/local/apache2.4/bin/apachectl-tsyntax OK[[email  Protected] 111.com]#/usr/local/apache2.4/bin/apachectl graceful[[email protected] 111.com]# curl-x127.0.0.1 : http://111.com/123.php '-ihttp/1.1 403 forbiddendate:tue, APR 2018 15:42:54 gmtserver:apache/2.4.29 (Unix) PHP/5 .6.35content-type:text/html; Charset=iso-8859-1[[email protected] 111.com]# curl-a "Aminglinux aminglinux"-x127.0.0.1:80 "http://111.com/ 123.php '-ihttp/1.1 okdate:tue, APR 2018 15:43:25 gmtserver:apache/2.4.29 (Unix) php/5.6.35x-powered-by:php/5.6. 35cache-control:max-age=0expires:tue, 17 APR 2018 15:43:25 gmtcontent-type:text/html; Charset=utf-8

11.30-31 PHP Related Configuration

View PHP configuration file Locations

/usr/local/php/bin/php-i|grep-i "Loaded configuration file"//may not be found

/usr/local/php/etc/php.ini

date.timezone = Asia/Shanghaidisable_functions = eval,assert,popen,passthru,escapeshellarg,escapeshellcmd,passthru,exec,system,chroot,scandir,chgrp,chown,escapeshellcmd,escapeshellarg,shell_exec,proc_get_status,ini_alter,ini_restore,dl,pfsockopen,openlog,syslog,readlink,symlink,leak,popepassthru,stream_socket_server,popen,proc_open,proc_close,phpinfo设置以下几项可以保存错误日志：display_errors = Off    //设置为 Off, 为 On 时，浏览器访问phpinfo时会显示错误信息，不建议设置为onlog_errors = On     //错误日志开启error_log = /tmp/php_errors.log    //设置错误日志路径error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT    //设置错误日志级别安全相关:vim /usr/local/php/etc/php.ini    open_basedir = /data/wwwroot/111.com:/tmp/vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf    //能够针对各个虚拟主机设置open_basedir    php_admin_value open_basedir "/data/wwwroot/111.com:/tmp/"PHP信息内容    [[email protected] 111.com]# vim index.php    <?php    phpinfo();    设置完可通过浏览器访问111.com/index.php 查看phpinfo

Operation Process

[[email protected] ~]# /usr/local/php/bin/php -i|grep -i "loaded configuration file"PHP Warning:  Unknown: It is not safe to rely on the system‘s timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected the timezone ‘UTC‘ for now, but please set date.timezone to select your timezone. in Unknown on line 0Loaded Configuration File => /usr/local/php/etc/php.ini

[Email protected] ~]# Vim/usr/local/php/etc/php.ini

Date.timezone = Asia/shanghai
Display_errors = On
Log_errors = On
Error_log =/tmp/php_errors.log
error_reporting = E_all & ~e_deprecated & ~e_strict
Open_basedir =/data/wwwroot/111.com:/tmp/

Disable_functions = Eval,assert,popen,passthru,escapeshellarg,escapeshellcmd,passthru,exec,system,chroot,scandir , Chgrp,chown,escapeshellcmd,escapeshellarg,shell_exec,proc_get_status,ini_alter,ini_restore,dl,pfsockopen, Openlog,syslog,readlink,symlink,leak,popepassthru,stream_socket_server,popen,proc_open,proc_close,phpinfo

[Email protected] ~]# vim/usr/local/apache2.4/conf/extra/httpd-vhosts.conf
<virtualhost *:80>
ServerAdmin [email protected]
DocumentRoot "/data/wwwroot/abc.com"
ServerName abc.com
Serveralias www.abc.com www.123.com
Php_admin_value Open_basedir "/data/wwwroot/abc.com:/tmp/"
Errorlog "Logs/abc.com-error_log"
Customlog "Logs/abc.com-access_log" common
</VirtualHost>

<virtualhost *:80>
DocumentRoot "/data/wwwroot/111.com"
ServerName 111.com
Serveralias www.exampl.com 2111.com.cn
Php_admin_value Open_basedir "/data/wwwroot/111.com:/tmp/"

2018-04-18 Linux Learning